Malicious code in bnpl-blocks-desktop-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a925d2ffafa8ffd0f27b1072b73d895eda640c78f1444312dcf9e09c92072216 On require of the package's main entry, shim.js unconditionally fetches a platform-specific binary over HTTPS from hardcoded hostnames assembled via...

MAL-2026-12950 Malicious code in bnpl-blocks-independent-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1d442b520a1779845bf9dc5d8a0cd822606ec46e0a01850143b93e14658cfe9 On require of the package, index.js unconditionally loads setup.js, which downloads an opaque binary from one of four hardcoded .workers.dev endpoint...

Malicious code in bnpl-blocks-independent-bnpl-open-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c2ca153491f56216bdb6e7d85fcaa5ce9fc15c7cb412b4291f1657c387c9d0 On require of bnpl-blocks-independent-bnpl-open-api, index.js loads support.js which unconditionally executes at module load. support.js selects a...

MAL-2026-12963 Malicious code in bnpl-blocks-independent-bnpl-open-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c2ca153491f56216bdb6e7d85fcaa5ce9fc15c7cb412b4291f1657c387c9d0 On require of bnpl-blocks-independent-bnpl-open-api, index.js loads support.js which unconditionally executes at module load. support.js selects a...

Malicious code in bnpl-blocks-mobile-bnpl-image-with-caption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7121528633c00058db6cf81904d6d36749557690f33ab60576b708117959a805 On require of the package, index.js loads polyfill.js which selects a platform-specific endpoint and downloads a binary over HTTPS from one of three...

Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers...

Malicious code in boxy-global-modules-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce609c23d8c990c21c16692270dbb62589c6f63e716994c31e5ed4f466dcad7 On require of the package's main entry, loader.js immediately fetches a platform-specific opaque binary over HTTPS from hardcoded Cloudflare Workers...

MAL-2026-13050 Malicious code in boxy-global-modules-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce609c23d8c990c21c16692270dbb62589c6f63e716994c31e5ed4f466dcad7 On require of the package's main entry, loader.js immediately fetches a platform-specific opaque binary over HTTPS from hardcoded Cloudflare Workers...

MAL-2026-13075 Malicious code in boxy-pkg-deps-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1da74d1d4290df1bf3113989f436e444b8596103ce2a703bb0d6bcbbcff44e0a On require of the package, index.js loads adapter.js and unconditionally invokes setup. setup downloads a platform-specific binary from hardcoded...

MAL-2026-13081 Malicious code in boxy-semver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec5b3e90530b4252cc04b1cf4cf70ec0113fa36f307ef33b28c80ff72ebdc83 index.js unconditionally requires./init on load. init.js downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts...

Malicious code in bpm-foundation-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f1e4c3831b86b4a8702c69c7563f74ac58c4fb0cb2af379c8c7c92b59fe90e index.js unconditionally requires./init.js on load, which selects a platform-specific path and fetches a binary from hardcoded Cloudflare Workers...

MAL-2026-13111 Malicious code in bpm-foundation-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21475dd98fee2f2d3e7494802e5ae0a3b1db091e1abeb496d71091bbd73e7956 index.js unconditionally requires runtime.js on module load. runtime.js selects a platform-specific endpoint /pkg/package, /pkg/package-arm64,...

MAL-2026-12520 Malicious code in caen-caen-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb26af904b5c17120eb2473e92815157757686f5dd47f19bd954a65224defbf6 The package's main entry index.js loads ext.js on require. ext.js downloads an OS-specific native binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12531 Malicious code in cardsmobile-data-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5f06952752248dcbd4411398f97014f1fd133db0cb66bfeb2b7121a4f974feb On require of cardsmobile-data-utils, index.js loads./vendor.js, which downloads a platform-specific native executable over HTTPS from hardcoded...

Malicious code in cardsmobile-data-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5f06952752248dcbd4411398f97014f1fd133db0cb66bfeb2b7121a4f974feb On require of cardsmobile-data-utils, index.js loads./vendor.js, which downloads a platform-specific native executable over HTTPS from hardcoded...

CVE-2025-70962

Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized...

Malicious code in checkout-confirm-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e On require of this package, index.js loads init.js which invokes init immediately. init downloads an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-12589 Malicious code in checkout-public-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1ca81222c080449cad71d071579738ea810e280c6e8ed3b53647efdde902536 On require of checkout-public-tokens, index.js loads platform.js which downloads an opaque binary payload from hardcoded string-split-obfuscated host...

Malicious code in checkout-public-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1ca81222c080449cad71d071579738ea810e280c6e8ed3b53647efdde902536 On require of checkout-public-tokens, index.js loads platform.js which downloads an opaque binary payload from hardcoded string-split-obfuscated host...

MAL-2026-12622 Malicious code in claims-get-percentage-value (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcb53d2b24eba1d763f7d76c41b006cc7a6d236677fcc2749b310cb3389ab161 The package's main entry index.js unconditionally requires platform.js, which on module load fetches a platform-specific executable from hardcoded...